IBM has disclosed a critical-rated (CVSS 9.6) path traversal flaw in IBM DataStage on Cloud Pak for Data 5.4.0.0. According to IBM, the flaw could allow a remote, authenticated attacker to cause a denial of service.
What Is It
CVE-2026-82101 is a path traversal vulnerability (CWE-22) in IBM DataStage on Cloud Pak for Data. IBM PSIRT says the flaw "could allow a remote authenticated attacker to cause a denial of service." IBM PSIRT submitted the record, and NVD published it on 2026-10-12. Its NVD status is currently "Received," which means NVD has not yet run its own analysis.
Why It Matters
IBM assigned a CVSS v3.1 base score of 9.6 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H. That vector means:
- Network-reachable with low attack complexity
- Requires only low privileges and no user interaction
- Scope changed, so the impact can extend beyond the vulnerable component
- High integrity and availability impact, with no confidentiality impact
The written description only mentions denial of service, but the vector also rates integrity impact as high. Defenders should not assume the risk is limited to availability until IBM's advisory says otherwise.
On exploitation status: this CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, so KEV does not confirm active exploitation. CISA's SSVC assessment, as coordinator, rates exploitation as "none", automatable as "no", and technical impact as "partial."
What's Vulnerable
- Vendor: IBM
- Product: DataStage on Cloud Pak for Data
- Affected version: 5.4.0.0
- CPE:
cpe:2.3:a:ibm:datastage_on_cloud_pak_for_data:5.4.0.0:*:*:*:*:*:*:*
The supplied record lists no other versions as affected.
Patch Status
The supplied NVD data does not name a fixed version or specific remediation steps. IBM has published a security bulletin for this issue (linked below). Organizations running DataStage on Cloud Pak for Data 5.4.0.0 should read that bulletin for fix and mitigation guidance and apply it promptly.
Because exploitation requires authentication, admins should also review who has access to DataStage on affected deployments until the fix is in place. There is no CISA KEV required action or due date, since the CVE is not listed in KEV.
Sources
- IBM Security Bulletin – node 7288649
- NVD – CVE-2026-82101
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE)